GoFundMe Security

GoFundMe takes security seriously. Outlined below are security practices we have implemented to secure and protect data.

Organisational security

The GoFundMe security programme is aligned to the NIST Cybersecurity Framework Functions and a combination of controls from NIST 800-53, CIS CSC Top 20 and the PCI Data Security Standard.

Audits and 3rd party assessments for compliance

Audits: Annually, GoFundMe engages external Assessors to audit its compliance with PCI requirements.

Continuous Testing: GoFundMe engages external Scanning and Penetration Testers to conduct network level and application level penetration testing and vulnerability scanning.

Software development life cycle

GoFundMe’s software development life cycle is fully integrated with our security organisation and strategy. Assessment of risks of software projects is based on the OWASP Top 10. Secure coding principles are emphasised and developers undergo recurrent secure coding training. Static Code Analysis, Dynamic Code Analysis and Software Composition Analysis are done at multiple stages of the software development lifecycle. All code is version controlled, subject to peer review, integration, functional, and QA testing.

How we protect customer data

GoFundMe takes a number of steps to protect customer data. This is a collaborative effort to identify and mitigate risks and implement best practices.

Data encryption in transit

Data submitted to the GoFundMe website and transmitted over public/open networks is encrypted. TLS version 1.2+ protocols are used and an AES 256 bit cryptographic algorithm is employed. The security team constantly monitors changing encryption standards, makes recommendations and implements changes as needed.

Encryption at rest

We use the FIPS-approved cryptographic algorithm – AES 256 bit when encrypting datasets at rest.

Secure infrastructure hosting service

GoFundMe infrastructure is hosted with Amazon Web Services. AWS maintains multiple certifications for its data centres, including ISO 27001 compliance and PCI DSS Certification. For more information about their certification and compliance, please visit the AWS Security Website.


Disaster recovery

GoFundMe uses services provided by AWS which include AWS Cloudfront CDN, AWS Application Load Balancing, AWS Availability Zones to distribute its production environment over different physical locations. These different physical locations protect the GoFundMe services from connectivity loss, power loss and other location-specific failures. High Availability is built into the GoFundMe infrastructure. In addition, infrastructure is configured by code & configuration management systems. This enables quick restoration of failed infrastructure. Full and incremental backups are maintained for critical data & infrastructure.

Compliance and certifications

GoFundMe does not store cardholder data as defined in the PCI Data Security Standard, however, GoFundMe has achieved the highest level of PCI Compliance as a PCI DSS Level 1 Compliant Service Provider. GoFundMe is annually audited by an independent PCI Qualified Security Assessor and complies with all the PCI Data Security Standard requirements. GoFundMe is listed on the Visa Global Registry of Service Provider’s website. GoFundMe’s PCI Attestation of Compliance is available on request.

Bug bounty and vulnerability disclosure programme

GoFundMe has a bug bounty/vulnerability disclosure programme. If you believe you have discovered potential security vulnerabilities on GoFundMe, we encourage you to disclose your discovery to us as quickly as possible. GoFundMe maintains a private bug bounty programme with the assistance of BugCrowd. Researchers are eligible for payment upon accepted unknown findings. While those who were not involved in the programme may still submit a security bug or vulnerability to GoFundMe via BugCrowd by filling out the form at the bottom of this page.

All submitted security bugs or vulnerabilities are subject to GoFundMe’s terms and conditions. By providing a submission, you agree that you may not publicly disclose your findings or the contents of your submission to any third parties without GoFundMe’s prior written approval.

Ineligible vulnerabilities

  1. DoS/DDoS
  2. Reports of spam
  3. Social engineering
  4. Unconfirmed reports from automated vulnerability scanners
  5. Disclosure of server or software version numbers
  6. Hypothetical sub-domain takeovers without supporting evidence
  7. Session invalidation or other improved security related to account management when a credential is already known (e.g. password reset link does not immediately expire, adding MFA does not expire other sessions, etc.)
  8. Perceived security weaknesses without concrete evidence of the ability to compromise a user (e.g. missing rate limits, missing headers etc.)
  9. Reports exploiting the behaviour of or vulnerabilities in outdated browsers
  10. User/merchant enumeration
  11. Best practice reports without a valid exploit (e.g. use of “weak” TLS ciphers)
  12. Disclosure of known public files or directories (e.g. robots.txt)
  13. Domain Name System Security Extensions (DNSSEC) configuration suggestions
  14. Banner disclosure on common/public services
  15. Lack of Secure/HTTPOnly flags on non-sensitive cookies
  16. Presence of application or web browser “autocomplete” or “save password” functionality
  17. Sender Policy Framework (SPF) configuration suggestions
  18. CSRF
  19. Contact us Form
  20. Messaging


In scope

  • gofundme.com
  • api.gofundme.com
  • funds.gofundme.com
  • gateway.gofundme.com

Out of scope

  • happiness.gofundme.com
  • Charity.gofundme.com
  • Charitysupport.gofundme.com
  • Charitysandbox.gofundme.com
  • fastly.gofundme.com
  • support.gofundme.com
  • community.gofundme.com

Submit bugs here